import sys, re, operator

anomaly = {}
nonstable_alarm = {}
stable_alarm = {}
hijack_file = open('./anomalies.format')
for l in hijack_file:
  c = l[:-1].split('|') # time, pfx, home, bad_path, is_hijk
  if c[2] != "0":
    if c[4] == 'Y':
      if c[1] not in stable_alarm:
        stable_alarm[c[1]] = set()
      stable_alarm[c[1]].add('AS%s' % c[2])
    elif c[4] == '6':
      if c[1] not in nonstable_alarm:
        nonstable_alarm[c[1]] = set()
      nonstable_alarm[c[1]].add('AS%s' % c[2])
    else:
      if c[1] not in anomaly:
        anomaly[c[1]] = set()
      anomaly[c[1]].add('AS%s' % c[2])
hijack_file.close()

import requests
get_req = requests.session()
pfxurl = 'http://bgp.he.net/net/'
def get_whois(prefixes, mark):
  sum_whois = 0
  sum_match = 0
  sum_one_whois = 0
  sum_one_match = 0
  for p, orig in prefixes.iteritems():
    try:
      print "%s|%s|%s|" % (mark, p, ' '.join(orig)),
      get_resp = get_req.get('%s%s' % (pfxurl, p), timeout=60)
      if get_resp and get_resp.text:
        irr_match = re.match(
            ".+<div id='whois' class='tabdata hidden'>.+<pre>([^<]+)</pre>",
            get_resp.text, re.DOTALL)
        if irr_match:
          lines = irr_match.group(1).split('\n')
          has_origin = 0
          match_origin = 0
          for l in lines:
            if l.startswith('origin:'):
              c = l.split(' ')
              for v in c:
                if v.startswith('AS'):
                  has_origin += 1
                  if v in orig:
                    match_origin += 1
                    print '%s*' % v, 
                  else:
                    print v, 
          if has_origin:
            sum_whois += len(orig)
            sum_match += match_origin
          if has_origin == 1:
            sum_one_whois += len(orig)
            sum_one_match += match_origin
      print
    except Exception as e:
      print
      print >> sys.stderr, "Error:", e
  if sum_whois:
    print >> sys.stderr, "all: %d %d %lf" % (
        sum_match, sum_whois,
        sum_match * 100. / sum_whois)
  if sum_one_whois:
    print >> sys.stderr, "one: %d %d %lf" % (
        sum_one_match, sum_one_whois,
        sum_one_match * 100. / sum_one_whois)

print >> sys.stderr, "Stable alarms"
get_whois(stable_alarm, 'Y')
print >> sys.stderr, "Non-stable alarms"
get_whois(nonstable_alarm, '6')
print >> sys.stderr, "Anomalies"
get_whois(anomaly, '-')

